CVE-2025-62585
📋 TL;DR
This vulnerability allows attackers to bypass Content Security Policy (CSP) protections in Whale browser by exploiting a specific scheme in dual-tab environments. Attackers could execute malicious scripts that would normally be blocked by CSP. Users of Whale browser versions before 4.33.325.17 are affected.
💻 Affected Systems
- Whale Browser
📦 What is this software?
Whale by Navercorp
⚠️ Risk & Real-World Impact
Worst Case
Complete CSP bypass allowing cross-site scripting (XSS) attacks, session hijacking, credential theft, and malware delivery through compromised websites.
Likely Case
Limited XSS attacks on vulnerable websites, potentially stealing user data or performing actions on behalf of the user.
If Mitigated
Minimal impact if websites implement additional security layers beyond CSP or if users avoid untrusted websites.
🎯 Exploit Status
Exploitation requires crafting malicious web content and convincing users to visit it. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.33.325.17 and later
Vendor Advisory: https://cve.naver.com/detail/cve-2025-62585.html
Restart Required: Yes
Instructions:
1. Open Whale browser. 2. Click menu (three dots) → Help → About Whale. 3. Browser will automatically check for updates. 4. If update available, click 'Update' and restart browser.
🔧 Temporary Workarounds
Disable dual-tab functionality
allTemporarily disable the dual-tab feature that contains the vulnerability
Use alternative browser
allSwitch to a different browser until Whale is updated
🧯 If You Can't Patch
- Implement strict network filtering to block known malicious domains
- Educate users to avoid clicking suspicious links and visiting untrusted websites
🔍 How to Verify
Check if Vulnerable:
Check Whale browser version: Open browser → Menu → Help → About Whale. If version is below 4.33.325.17, you are vulnerable.Check Version:
Not applicable - check through browser GUI as describedVerify Fix Applied:
After updating, verify version is 4.33.325.17 or higher in About Whale screen.📡 Detection & Monitoring
Log Indicators:
- Unusual CSP violation reports in web server logs
- Multiple failed CSP directives from same user session
Network Indicators:
- Unexpected script loads bypassing CSP headers
- Suspicious scheme usage in HTTP requests
SIEM Query:
web.csp.violation: * AND (user_agent: *Whale* OR browser: Whale) AND version < 4.33.325.17